Tuesday, November 22, 2016

IGI Attribute Hierarchies

IBM Security Identity Governance & Intelligence (or IGI for short) has a very neat feature whereby hierarchies can be constructed using any attribute associated with an identity. Now, instead of identities being firmly placed within a rigid organizational hierarchy, additional hierarchies can be created to help model entitlements more accurately.

For example, it could be useful for everyone who reports to a specific manager to be automatically assigned a suite of entitlements. Additionally, we could find that rights should be assigned based on regional or office location.

Fundamentally, the assignment of this rights is somewhat akin to how IBM Security Identity Manager could be configured with dynamic roles - except IGI's approach is so much more powerful.

For example, let's consider identity records that contain the following attributes:
  • Country
  • City
  • Address

It could be interesting to model that hierarchy and "virtually" place identities in a hierarchy that might look like this:

- United Kingdom
- - Belfast
- - - 1 Main Street
- - London
- - - 2 High Street
- - - 3 Oxford Street
- - - 4 Piccadilly
- France
- - Paris
- - - 5 Rue de Provence


Modelling the hierarchy is simple. As an IGI administrator, one merely needs to navigate to Access Governance Core > Configure > Rules. In here, we can create a Rules Sequence called  LOCATION_HIERARCHY of type Hierarchy.

Now, within the Rules tab, we can select the rule class Hierarchy and rule flow LOCATION_HIERARCHY (ignoring the fact that the naming convention mismatch between sequence and flow is rather annoying).

Within the package imports section, we would place the following:

import com.engiweb.profilemanager.common.bean.UserBean
import com.crossideas.certification.common.bean.data.ResultBean
import com.engiweb.profilemanager.common.ruleengine.action.UtilAction
import java.util.ArrayList

global com.engiweb.pm.dao.db.DAO sql
global com.engiweb.logger.impl.Log4JImpl logger

This suite of imports exposing methods which we can now use. Our next step is to CREATE a Rules Package with the following code:

    userBean : UserBean(  )  
    resultBean : ResultBean(  )
/* Country>City>Office */
    String country = userBean.getCountry();
    String city = userBean.getLocality();
    String office = userBean.getAddress();

    if (country != null && city != null && office != null) {
        resultBean.setResultString("World;" + country + ";" + city + ";" + office); 
    } else {

What does this code do? Well, it iterates over every identity in the platform and constructs a string of World;Country;City;Office which can be passed back to the core platform in order to construct a hierarchy. Give the package a "sensible" name (like Country>City>Office) and assign it to the LOCATION_HIERARCHY rule flow.

The next step is to Access Governance Core > Configure > Hierarchy in order to create a hierarchy that can use our rule flow. Under the Actions link, click on Add. Populate the blank form with the following details:

Name: Location Hierarchy
Configuration Type: Advanced
Value: Hierarchy
Separator Char: Semi-Colon (;)

Save the hierarchy, re-select it and under Actions, click on BUILD. Now the system will build an appropriate hierarchy which can be viewed under Access Governance Core > Manage > Groups.

So what can we do now?

Well... let's assume we want everyone in the United Kingdom to be assigned a role. Create and publish role called "United Kingdom Users". Now configure the role by updating the Org Units it is assigned to (ignoring the fact it is called Org Units which will no doubt be resolved in a future fix pack!). Add an "Org Unit" of type Location Hierarchy, navigate down through the hierarchy and find United Kingdom, click on OK and complete the following:

Default: Yes, and align users
Visibility Violation: No
Enabled: Yes
Hierarchy: Checked

That's it... every user under the United Kingdom hierarchy will automatically be assigned the United Kingdom Users role.

Tuesday, August 30, 2016

Javadoc Updates

It has been a while, but I've finally got round to uploading the latest Javadocs for IBM Security Identity Manager v7.0 and IBM Security Access Manager v9.0.

These can be found by following the links from here: https://www.stephen-swann.co.uk/links-and-tools/

Enjoy - if it's possible to enjoy Javadocs!

Wednesday, March 23, 2016

Property Changes In TDI - On The Fly

This week, I was asked if it was possible to update a TDI property while the TDI server was still running and, if so, how to go about doing it.

The reason for wanting to do so was akin to injecting a property into TDI at run-time so that it would "safely" shutdown an Assembly Line at a sensible point of processing. Now, there are many ways to address this actual requirement, but the fundamental question of how to inject a property into TDI is certainly something that can be explained easily.

The tdisrvctl command is a terrific command for communicating with a running TDI server. In order to communicate with the TDI server, you merely need to supply some key information, such as the Port Number that the TDI Server API is listening on, and some means to identify yourself using the TDI keystores. Finally, you supply an "operation" for the TDI Server to perform. Manipulating properties can be performed with the "prop" operation. In summary, tdisrvctl needs the following parameters:

  • -p {port}
  • -K {keystore}
  • -P {keystore password}
  • -T {trust store}
  • -W {trust store password}
  • -op prop

I set up a Project in TDI called propertyhandling, with an assemblyline called propertyhandling and a property in the propertyhandling properties file called status with a value of run.

In my AL, I created a conditional WHILE loop with this code:

if (system.getExternalProperty("status") == "run") {
      return true;
} else {
      return false;

I ran the AL and it trundles along nicely doing nothing but looping and consuming all available CPU. You got to love never-ending loops!

I then ran this command:

tdisrvctl.bat -p 1091 -T C:\TDISOL\testserver.jks -W server -K C:\TDISOL\serverapi\testadmin.jks -P administrator -op prop -c propertyhandling -o propertyhandling -g all

The -c, -o and -g options after the prop operation need a little explaining:

  • -c this is the Solution Name for my configuration, in this case propertyhandling
  • -o this is the name of the properties collection, in this case propertyhandling
  • -g this tells the TDI Server to return the property value for the property named, in this case all means return the values for all the properties in the properties file

When I run the command, the result I get on-screen is this:

--- propertyhandling ---


This is excellent news, I'm able to query the current properties held in this particular properties file. Swapping that -g argument for a -s argument means I can now manipulate the status property as such:

tdisrvctl.bat -p 1091 -T C:\TDISOL\testserver.jks -W server -K C:\TDISOL\serverapi\testadmin.jks -P administrator -op prop -c propertyhandling -o propertyhandling -s status=stop

The -s require a property/value pair to be supplied. In this case, -s is telling the TDI Server to set the value of property status to stop. When I run this command, I get this result:

CTGDJB070I The property status has been set and committed.

That looks positive and when I check whether my assemblyline is still running, I find that it has indeed come to an end - as expected. Thanks goodness, says my CPU!

Of course, there are a myriad of use cases for injecting properties at run time... safe shut-down of an assemblyline is just one.